Julian Köhn is Founder and CEO of Kopexa. He has been building security and compliance solutions for European mid-market companies for over 10 years. Focus areas: NIS2, ISO 27001, GDPR, TISAX. Kopexa was founded to make GRC transparent and self-service for SMEs.
Articles
Malware in job applications: Assess your recruiting workflow
A résumé as a ransomware entry point: What HR and IT should check in intake, sharing and reporting, including an authorised testing scenario.
Julian Köhn·
Windows 10 LTSB 2016: Which legacy devices should you check now?
Windows 10 LTSB 2016 reaches end of support. Assess affected systems, business impact and decisions on migration, ESU or time-limited operation.
Julian Köhn·
Cyber risks in SMEs: Which actions come first?
A practical worksheet for cybersecurity priorities, accountable actions and verifiable outcomes.
Julian Köhn·
Security awareness: Does your team know what to do?
Beyond attendance: a 20-minute exercise to check whether your team can report suspicious messages and improve the process.
Julian Köhn·
Refrigeration cyberattack: Which dependencies put your operations at risk?
The attack on French refrigeration systems highlights an operational risk. Connect critical assets, suppliers, business impact analysis and verifiable actions.
Julian Köhn·
AI agents at work: Who can act, and who stays accountable?
AI agents do more than read. Define access, approvals and ownership, then make their risks and safeguards traceable in your existing ISMS.
Julian Köhn·
ISO/IEC 27090: bringing AI security risks into your ISMS
Understand the scope of ISO/IEC 27090 and connect AI applications, suppliers and data risks to practical work in your existing ISMS.
Julian Köhn·
Vendor assessment: criteria, weighting and an Excel template
Assess vendors using relevant criteria, weighted responses and knockout conditions. Free Excel template with instructions and a worked example.
Julian Köhn·
Germany's NIS2 rules: group IT, MSPs and negligible activities
When group IT qualifies as an MSP, how Germany's BSI interprets negligible activities and why a small IT subsidiary is not automatically exempt from NIS2.
Julian Köhn·
Create a risk matrix: Excel template and worked example
Build an information-security risk matrix. Free Excel template with dynamic matrices, a risk register and initial and residual risk examples.
Julian Köhn·
ISO 27001 Checklist: Step by Step to Certification
ISO 27001 checklist with about 30 checkpoints for certification and ISMS setup, every step explained, free PDF download.
Julian Köhn·
Choosing ISMS Software: Requirements Catalog & Checklist
Choosing ISMS software: requirements catalog with about 30 criteria, must-have vs nice-to-have, and a free checklist download.
Julian Köhn·
ISMS Software: Which One Helps with ISO 27001, TISAX and NIS2?
ISMS software compared: selection criteria, features and costs for ISO 27001, TISAX and NIS2. The practical guide for your decision.
Julian Köhn·
ISO 27001 Certification Explained Simply: Process & Costs
What ISO 27001 certification means, who actually needs it, and how the process runs from Stage 1 to recertification, explained clearly for beginners.
Julian Köhn·
ISO 27001 and Data Protection: GDPR, TOMs and Evidence
Does ISO 27001 cover GDPR? Understand Article 32 TOMs and follow eight practical steps, with evidence, ownership and a worked example.
Julian Köhn·
GDPR Subject Access Request: How to Answer a DSAR Lawfully
A DSAR (Data Subject Access Request) under Art. 15 GDPR must be answered within 30 days. We walk you through the 8-step workflow from identity verification to data extraction and redaction, and which grounds for refusal are legally defensible.
Julian Köhn·
What Is OSCAL? A Deep Dive Into Compliance as Code and BSI Grundschutz++
OSCAL turns security controls into machine-readable data. BSI Grundschutz++ adopts it as its native core. We explain the architecture, PDCA methodology and what the January 1, 2026 standard switch means for your ISMS.
Julian Köhn·NIS2 Germany: Complete Guide for International Companies (2026)
Everything an international company with operations in Germany needs to know about NIS2 / NIS2UmsuCG: who is in scope, deadlines, registration with the BSI, fines, and how DORA and KRITIS fit in.
Julian Köhn·
What Is an ISMS? Definition, Examples and Implementation Guide
What an ISMS is, which documents you need and how to build it: a clear definition, three examples and a practical implementation plan.
Julian Köhn·
Palantir: A Lesson in Vendor Risk Management
Switzerland blocks Palantir, Germany pushes it through bypassing parliament. An analysis of devastating risks and the sell-out of digital sovereignty.
Julian Köhn·
NIS2 Executive Management: Training Obligation & Liability 2025
Mandatory training under NIS2: who is affected? What liability do directors face? All content, obligations & risks explained simply. Get informed now.
Julian Köhn·
Running Matomo in a Privacy-Compliant Way: How to Do It Without a Cookie Banner
Configure cookieless Matomo: JavaScript, Tag Manager, IP masking and privacy notice, with real screenshots and a German privacy-law assessment.
Julian Köhn·
5 Benefits of Automated Risk Analysis for Mid-Sized Companies
Learn how automated risk analysis helps SMEs detect risks early, ensure compliance and improve decision-making.
Julian Köhn·
What Does Compliance Software Cost? Annual Budget for SMEs
Budget separately for software, implementation, consulting and audits: a cost overview, worked SME example and vendor comparison.
Julian Köhn·
NIS2: The Underestimated Obligation for SMEs and Suppliers
NIS 2 obliges SMEs and suppliers to meet higher cybersecurity standards, reporting channels and ISMS integration for greater digital resilience.
Julian Köhn·
Certification Roadmap: ISO 9001 to 27001
Certification roadmap for ISO standards: Start with ISO 9001, leverage synergies with ISO 14001/27001. Reduce implementation time by 50% and save costs.
Julian Köhn·
DevOps & GDPR: Anonymising Data Automatically
How to maintain GDPR compliance in DevOps: automated anonymisation and pseudonymisation, PostgreSQL RLS/data masking, CI/CD integration for risk-free testing.
Julian Köhn·
ESG Compliance: How to Master the New Reporting Obligations
The CSRD is coming: learn how to use ESG compliance as a strategic advantage and turn it into a game-changer with Kopexa!
Julian Köhn·